@sebastienrousseau/dotfiles 0.2.499 → 0.2.501

package/scripts/diagnostics/verify.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Dotfiles post-merge verification checks
+# Runs doctor + status + diff checks and exits non-zero on issues.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+
+ui_init
+ui_dot_banner "Diagnostics"
+ui_header "Dotfiles Verify"
+echo ""
+
+failures=0
+dot_bin=""
+RUN_SECURITY=0
+
+# Parse arguments
+for arg in "$@"; do
+  case "$arg" in
+    --security | -s) RUN_SECURITY=1 ;;
+  esac
+done
+
+resolve_dot_bin() {
+  if command -v dot >/dev/null 2>&1; then
+    command -v dot
+    return
+  fi
+  if [[ -x "$HOME/.local/bin/dot" ]]; then
+    printf "%s\n" "$HOME/.local/bin/dot"
+    return
+  fi
+  local src_dir=""
+  if [[ -n "${CHEZMOI_SOURCE_DIR:-}" && -d "${CHEZMOI_SOURCE_DIR}" ]]; then
+    src_dir="${CHEZMOI_SOURCE_DIR}"
+  elif [[ -d "$HOME/.dotfiles" ]]; then
+    src_dir="$HOME/.dotfiles"
+  elif [[ -d "$HOME/.local/share/chezmoi" ]]; then
+    src_dir="$HOME/.local/share/chezmoi"
+  fi
+  if [[ -n "$src_dir" && -x "$src_dir/dot_local/bin/executable_dot" ]]; then
+    printf "%s\n" "$src_dir/dot_local/bin/executable_dot"
+    return
+  fi
+  return 1
+}
+
+run_step() {
+  local label="$1"
+  shift
+
+  ui_info "Running" "$label"
+  set +e
+  "$@"
+  local ec=$?
+  set -e
+
+  if [[ $ec -eq 0 ]]; then
+    ui_ok "$label" "ok"
+  else
+    ui_err "$label" "failed (exit $ec)"
+    failures=$((failures + 1))
+  fi
+}
+
+if dot_bin="$(resolve_dot_bin)"; then
+  if [[ $RUN_SECURITY -eq 1 ]]; then
+    run_step "security-score" "$dot_bin" security-score
+  else
+    run_step "dot doctor" "$dot_bin" doctor
+    run_step "dot status" "$dot_bin" status
+  fi
+else
+  # shellcheck disable=SC1091
+  ui_err "dot binary" "not found in PATH, ~/.local/bin, or source tree"
+  failures=$((failures + 1))
+fi
+
+ui_info "Running" "chezmoi diff"
+set +e
+diff_output="$(chezmoi diff 2>&1)"
+diff_ec=$?
+set -e
+if [[ $diff_ec -eq 0 ]]; then
+  ui_ok "chezmoi diff" "clean"
+else
+  ui_warn "chezmoi diff" "drift detected"
+  if [[ -n "$diff_output" ]]; then
+    printf "%s\n" "$diff_output"
+  fi
+  failures=$((failures + 1))
+fi
+
+echo ""
+if [[ $failures -eq 0 ]]; then
+  ui_ok "Verification" "all checks passed"
+  exit 0
+fi
+
+ui_err "Verification" "$failures check(s) failed"
+ui_info "Hint" "Run 'dot heal' then re-run 'dot verify'"
+exit 1

package/scripts/{verify_state.sh → diagnostics/verify_state.sh}

@@ -1,33 +1,33 @@
 #!/usr/bin/env bash
 # MIT License
-# Copyright (c) 2026 Sebastien Rousseau
+# Copyright (c) 2026
 # See LICENSE file for details.
 
 # Script: verify_state.sh
 # Description: Final verification of the dotfiles environment state.
 
-set -e
+set -euo pipefail
 
-echo "🔍 Starting Final Environment Verification..."
+echo " Starting Final Environment Verification..."
 
 Errors=0
 
 check_file() {
-    if [[ ! -f "$1" ]]; then
-        echo "❌ Missing file: $1"
-        Errors=$((Errors + 1))
-    else
-        echo "✅ Found file: $1"
-    fi
+  if [[ ! -f "$1" ]]; then
+    echo " Missing file: $1"
+    Errors=$((Errors + 1))
+  else
+    echo " Found file: $1"
+  fi
 }
 
 check_alias_in_config() {
-    if ! grep -q "$1" "$HOME/.config/shell/aliases.sh"; then
-        echo "❌ Missing alias definition '$1' in built config"
-        Errors=$((Errors + 1))
-    else
-        echo "✅ Verified alias: $1"
-    fi
+  if ! grep -q "$1" "$HOME/.config/shell/aliases.sh"; then
+    echo " Missing alias definition '$1' in built config"
+    Errors=$((Errors + 1))
+  else
+    echo " Verified alias: $1"
+  fi
 }
 
 # 1. Verify Docs
@@ -35,9 +35,9 @@ check_file ".chezmoitemplates/aliases/security/README.md"
 check_file ".chezmoitemplates/aliases/legal/README.md"
 
 # 2. Verify Scripts
-check_file "scripts/lock-configs.sh"
-check_file "scripts/detect-collisions.py"
-check_file "scripts/test-aliases.sh"
+check_file "scripts/security/lock-configs.sh"
+check_file "scripts/tools/detect-collisions.py"
+check_file "tests/test-aliases.sh"
 
 # 3. Verify Generated Config Content (Key Features)
 # Security
@@ -52,9 +52,9 @@ check_alias_in_config "add-headers"
 check_file ".github/workflows/security-release.yml"
 
 if [[ $Errors -eq 0 ]]; then
-    echo "🎉 Verification Passed! All systems nominal."
-    exit 0
+  echo " Verification Passed! All systems nominal."
+  exit 0
 else
-    echo "⚠️  Verification Failed with $Errors errors."
-    exit 1
+  echo "️  Verification Failed with $Errors errors."
+  exit 1
 fi

package/scripts/diagnostics/version-locks.sh

@@ -0,0 +1,79 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Version Locks Summary
+# Usage: dot locks
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../dot/lib/ui.sh
+# shellcheck disable=SC1091
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+
+ui_init
+
+resolve_source_dir() {
+  if [[ -n "${CHEZMOI_SOURCE_DIR:-}" && -d "$CHEZMOI_SOURCE_DIR" ]]; then
+    printf "%s\n" "$CHEZMOI_SOURCE_DIR"
+    return
+  fi
+  if [[ -d "$HOME/.dotfiles" ]]; then
+    printf "%s\n" "$HOME/.dotfiles"
+    return
+  fi
+  if [[ -d "$HOME/.local/share/chezmoi" ]]; then
+    printf "%s\n" "$HOME/.local/share/chezmoi"
+    return
+  fi
+  return 1
+}
+
+src_dir=$(resolve_source_dir)
+
+ui_header "Version Locks"
+
+ui_section "mise toolchain"
+mise_config="$src_dir/dot_config/mise/config.toml"
+if [[ -f "$mise_config" ]]; then
+  awk -F= '
+    /^\[tools\]/ {in_tools=1; next}
+    /^\[/ {in_tools=0}
+    in_tools && NF {
+      gsub(/"/, "", $0)
+      tool=$1
+      gsub(/[[:space:]]+/, "", tool)
+      ver=$2
+      gsub(/^[[:space:]]+|[[:space:]]+$/, "", ver)
+      if (tool != "") {
+        printf "%s\t%s\n", tool, ver
+      }
+    }
+  ' "$mise_config" | while IFS=$'\t' read -r tool ver; do
+    [[ -n "$tool" ]] && ui_kv "$tool" "$ver"
+  done
+else
+  ui_warn "mise" "config not found"
+fi
+
+ui_section "Node/Python pins"
+if [[ -f "$src_dir/dot_node-version" ]]; then
+  ui_kv "node" "$(cat "$src_dir/dot_node-version")"
+fi
+if [[ -f "$src_dir/dot_noderc.tmpl" ]]; then
+  ui_kv "noderc" "$(sed -n '1p' "$src_dir/dot_noderc.tmpl")"
+fi
+
+ui_section "Package manager locks"
+if [[ -f "$src_dir/dot_config/shell/Brewfile" ]]; then
+  ui_kv "brew" "Brewfile present"
+fi
+if [[ -f "$src_dir/dot_config/shell/Brewfile.cli" ]]; then
+  ui_kv "brew-cli" "Brewfile.cli present"
+fi
+if [[ -f "$src_dir/package.json" ]]; then
+  ui_kv "node" "package.json version pinned"
+fi
+
+ui_section "Notes"
+ui_info "Policy" "Prefer LTS and explicit pins for core runtimes"
+ui_info "Update" "Edit ~/.config/mise/config.toml to adjust pins"

package/scripts/diagnostics/workstation-attestation.sh

@@ -0,0 +1,186 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+## Workstation attestation export.
+##
+## Produces a machine-readable evidence record for the current dotfiles
+## workstation state: version, platform, signing, MCP posture, and agent mode.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPO_ROOT="${REPO_ROOT:-$(cd "$SCRIPT_DIR/../.." && pwd)}"
+# Export so child processes (the mcp-doctor subprocess below) inherit it
+# without the env-prefix dance that confuses shellcheck (SC2097/SC2098).
+export REPO_ROOT
+
+# shellcheck source=../dot/lib/ui.sh
+source "$SCRIPT_DIR/../dot/lib/ui.sh"
+# shellcheck source=../dot/lib/platform.sh
+source "$SCRIPT_DIR/../dot/lib/platform.sh"
+# shellcheck source=../dot/lib/utils.sh
+source "$SCRIPT_DIR/../dot/lib/utils.sh"
+
+JSON_MODE=0
+WRITE_PATH=""
+FLEET_STORE=""
+FLEET_ID=""
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --json | -j)
+      JSON_MODE=1
+      shift
+      ;;
+    --write | -w)
+      WRITE_PATH="${2:-}"
+      shift 2
+      ;;
+    --fleet-store | -F)
+      FLEET_STORE="${2:-}"
+      shift 2
+      ;;
+    --fleet-id | -I)
+      FLEET_ID="${2:-}"
+      shift 2
+      ;;
+    *)
+      shift
+      ;;
+  esac
+done
+
+command -v jq >/dev/null 2>&1 || {
+  echo "jq is required for workstation attestation." >&2
+  exit 1
+}
+
+ui_init
+
+if [[ -z "$FLEET_STORE" && -n "${DOTFILES_FLEET_STORE:-}" ]]; then
+  FLEET_STORE="$DOTFILES_FLEET_STORE"
+fi
+
+attestation_dir="${XDG_STATE_HOME:-$HOME/.local/state}/dotfiles/attestations"
+if [[ -n "$WRITE_PATH" ]]; then
+  mkdir -p "$(dirname "$WRITE_PATH")"
+elif [[ "$JSON_MODE" -ne 1 && -z "$FLEET_STORE" ]]; then
+  mkdir -p "$attestation_dir"
+  WRITE_PATH="$attestation_dir/workstation-attestation.json"
+fi
+
+dot_version="$(dotfiles_version)"
+platform_id="$(dot_platform_id)"
+host_os="$(dot_host_os)"
+arch="$(uname -m)"
+hostname_value="$(hostname 2>/dev/null || true)"
+agent_profile_file="$REPO_ROOT/dot_config/dotfiles/agent-profiles.json"
+agent_card_file="$REPO_ROOT/dot_config/dotfiles/agent-card.json"
+agent_state_file="${AGENT_STATE_FILE:-$HOME/.config/dotfiles/agent-mode.env}"
+policy_bundles_file="$REPO_ROOT/dot_config/dotfiles/policy-bundles.json"
+model_registry_file="$REPO_ROOT/dot_config/dotfiles/model-registry.json"
+prompt_registry_file="$REPO_ROOT/dot_config/dotfiles/prompt-registry.json"
+mcp_policy_file="$REPO_ROOT/dot_config/dotfiles/mcp-policy.json"
+mcp_registry_file="$REPO_ROOT/dot_config/dotfiles/mcp-registry.json"
+signing_format="$(git config --global gpg.format 2>/dev/null || echo ssh)"
+signing_key="$(git config --global user.signingkey 2>/dev/null || true)"
+allowed_signers="$(git config --global gpg.ssh.allowedSignersFile 2>/dev/null || echo "$HOME/.config/git/allowed_signers")"
+merge_verify="$(git config --global --bool merge.verifySignatures 2>/dev/null || echo false)"
+
+if [[ -f "$agent_state_file" ]]; then
+  current_profile="$(sed -n 's/^DOT_AGENT_PROFILE=//p' "$agent_state_file" | tail -n 1)"
+else
+  current_profile=""
+fi
+if [[ -z "$current_profile" ]] && [[ -f "$agent_profile_file" ]]; then
+  current_profile="$(jq -r '.defaultProfile // "ask"' "$agent_profile_file")"
+fi
+
+MCP_CONFIG="$REPO_ROOT/dot_config/claude/mcp_servers.json"
+export MCP_CONFIG
+mcp_summary="$(bash "$REPO_ROOT/scripts/diagnostics/mcp-doctor.sh" --strict --json)"
+
+attestation_json="$(
+  jq -n \
+    --arg generated_at "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+    --arg repo_root "$REPO_ROOT" \
+    --arg version "$dot_version" \
+    --arg platform "$platform_id" \
+    --arg host_os "$host_os" \
+    --arg arch "$arch" \
+    --arg hostname "$hostname_value" \
+    --arg signing_format "$signing_format" \
+    --arg signing_key "$signing_key" \
+    --arg allowed_signers "$allowed_signers" \
+    --argjson merge_verify "$([[ "$merge_verify" == "true" ]] && echo true || echo false)" \
+    --arg current_profile "$current_profile" \
+    --argjson mcp "$mcp_summary" \
+    --slurpfile agent_profiles "$agent_profile_file" \
+    --slurpfile agent_card "$agent_card_file" \
+    --slurpfile policy_bundles "$policy_bundles_file" \
+    --slurpfile model_registry "$model_registry_file" \
+    --slurpfile prompt_registry "$prompt_registry_file" \
+    --slurpfile mcp_policy "$mcp_policy_file" \
+    --slurpfile mcp_registry "$mcp_registry_file" \
+    '{
+      generated_at: $generated_at,
+      repo_root: $repo_root,
+      dotfiles_version: $version,
+      platform: {
+        runtime: $platform,
+        host_os: $host_os,
+        architecture: $arch,
+        hostname: $hostname
+      },
+      git_signing: {
+        format: $signing_format,
+        signing_key: $signing_key,
+        allowed_signers_file: $allowed_signers,
+        merge_verify_signatures: $merge_verify
+      },
+      agent: {
+        current_profile: $current_profile,
+        profiles: $agent_profiles[0],
+        card: $agent_card[0]
+      },
+      governance: {
+        policy_bundles: $policy_bundles[0],
+        model_registry: $model_registry[0],
+        prompt_registry: $prompt_registry[0]
+      },
+      mcp: {
+        doctor: $mcp,
+        policy: $mcp_policy[0],
+        registry: $mcp_registry[0]
+      }
+    }'
+)"
+
+if [[ -n "$WRITE_PATH" ]]; then
+  printf '%s\n' "$attestation_json" >"$WRITE_PATH"
+fi
+
+if [[ -n "$FLEET_STORE" ]]; then
+  fleet_root="${FLEET_STORE%/}"
+  fleet_id="${FLEET_ID:-${DOTFILES_FLEET_ID:-default}}"
+  fleet_host="${hostname_value:-unknown-host}"
+  fleet_dir="$fleet_root/$fleet_id/$fleet_host"
+  fleet_file="$fleet_dir/workstation-attestation.json"
+  fleet_timestamp_file="$fleet_dir/workstation-attestation-$(date -u +%Y%m%dT%H%M%SZ).json"
+  mkdir -p "$fleet_dir"
+  printf '%s\n' "$attestation_json" >"$fleet_file"
+  printf '%s\n' "$attestation_json" >"$fleet_timestamp_file"
+fi
+
+if [[ "$JSON_MODE" -eq 1 ]]; then
+  printf '%s\n' "$attestation_json"
+else
+  ui_dot_banner "Diagnostics"
+  ui_header "Workstation Attestation"
+  ui_ok "Version" "$dot_version"
+  ui_ok "Platform" "$platform_id / $host_os / $arch"
+  ui_ok "Agent profile" "$current_profile"
+  ui_ok "MCP status" "$(printf '%s' "$mcp_summary" | jq -r '.status')"
+  ui_ok "Output" "$WRITE_PATH"
+  if [[ -n "$FLEET_STORE" ]]; then
+    ui_ok "Fleet store" "$fleet_root/$fleet_id/$fleet_host"
+  fi
+fi